Storybook Dev Server is Vulnerable to WebSocket Hijacking

Description

The WebSocket functionality in Storybook’s dev server, used to create and update stories, is vulnerable to WebSocket hijacking. This vulnerability only affects the Storybook dev server; production builds are not impacted.

Recommendation

Update the storybook package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 10.0.0-beta.0, < 10.2.10

  >= 8.7.0-alpha.0, < 9.1.19

  >= 8.1.0, < 8.6.17**

• Patched version(s): **10.2.10

  9.1.19

  8.6.17**

References

• GHSA-mjf5-7g4m-gx5w
• CVE-2026-27148
• CWE-1385
• CWE-74
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6